Analysis
-
max time kernel
35s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
17-07-2022 01:44
Static task
static1
Behavioral task
behavioral1
Sample
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe
Resource
win10v2004-20220414-en
General
-
Target
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe
-
Size
244KB
-
MD5
ef08c4b337a4aee8adabbd4d9197566f
-
SHA1
d6739a74ec4c85de2170b2d57ffe61cf3fffc6b7
-
SHA256
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654
-
SHA512
875206f79b7bcffbf55f03a439bf71dff8c1d4bfb0efa6d8a92745c5777867599a5fb1e444ac9c077b76f83aab0f9b42d53c2a1232904299c8956a420a1fe113
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JavaTray = "C:\\Windows\\traymgr.exe" 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe -
Executes dropped EXE 2 IoCs
Processes:
traymgr.exetraymgr.exepid process 1508 traymgr.exe 1636 traymgr.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftNAPC = "C:\\Windows\\traymgr.exe" 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftCorp = "C:\\Windows\\traymgr.exe" 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exetraymgr.exedescription pid process target process PID 1324 set thread context of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1508 set thread context of 1636 1508 traymgr.exe traymgr.exe -
Drops file in Windows directory 2 IoCs
Processes:
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exedescription ioc process File created C:\Windows\traymgr.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe File opened for modification C:\Windows\traymgr.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
traymgr.exedescription pid process Token: SeDebugPrivilege 1636 traymgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exetraymgr.exepid process 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 1508 traymgr.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exetraymgr.exetraymgr.exedescription pid process target process PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1324 wrote to memory of 1280 1324 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe PID 1280 wrote to memory of 1508 1280 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe traymgr.exe PID 1280 wrote to memory of 1508 1280 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe traymgr.exe PID 1280 wrote to memory of 1508 1280 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe traymgr.exe PID 1280 wrote to memory of 1508 1280 52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1508 wrote to memory of 1636 1508 traymgr.exe traymgr.exe PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE PID 1636 wrote to memory of 1220 1636 traymgr.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe"C:\Users\Admin\AppData\Local\Temp\52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe"C:\Users\Admin\AppData\Local\Temp\52d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654.exe" c:\users\admin\appdata\local\temp\Program.exeb3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\traymgr.exe"C:\Windows\traymgr.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\traymgr.exe"C:\Windows\traymgr.exe" c:\users\admin\appdata\local\temp\Program.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\traymgr.exeFilesize
244KB
MD5ef08c4b337a4aee8adabbd4d9197566f
SHA1d6739a74ec4c85de2170b2d57ffe61cf3fffc6b7
SHA25652d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654
SHA512875206f79b7bcffbf55f03a439bf71dff8c1d4bfb0efa6d8a92745c5777867599a5fb1e444ac9c077b76f83aab0f9b42d53c2a1232904299c8956a420a1fe113
-
C:\Windows\traymgr.exeFilesize
244KB
MD5ef08c4b337a4aee8adabbd4d9197566f
SHA1d6739a74ec4c85de2170b2d57ffe61cf3fffc6b7
SHA25652d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654
SHA512875206f79b7bcffbf55f03a439bf71dff8c1d4bfb0efa6d8a92745c5777867599a5fb1e444ac9c077b76f83aab0f9b42d53c2a1232904299c8956a420a1fe113
-
C:\Windows\traymgr.exeFilesize
244KB
MD5ef08c4b337a4aee8adabbd4d9197566f
SHA1d6739a74ec4c85de2170b2d57ffe61cf3fffc6b7
SHA25652d6a3c4fa56f1262d9c72fff59d3ce05b0844fb6ec63da498af06f9f2f86654
SHA512875206f79b7bcffbf55f03a439bf71dff8c1d4bfb0efa6d8a92745c5777867599a5fb1e444ac9c077b76f83aab0f9b42d53c2a1232904299c8956a420a1fe113
-
memory/1220-116-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-118-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-100-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-98-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-130-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-128-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-126-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-124-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-122-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-120-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-114-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-112-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-110-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-108-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-106-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-102-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-104-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-96-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1220-132-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1280-71-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1280-93-0x0000000002660000-0x000000000269D000-memory.dmpFilesize
244KB
-
memory/1280-60-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1280-62-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1280-91-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1280-57-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1280-64-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1280-65-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1280-67-0x000000000040E22A-mapping.dmp
-
memory/1280-58-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1324-70-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1324-66-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1324-56-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1508-72-0x0000000000000000-mapping.dmp
-
memory/1508-94-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1508-95-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1636-87-0x000000000040E22A-mapping.dmp
-
memory/1636-134-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB